DeforaNetworks/fwknop
3
0
Fork 0
Code Releases Activity

[server] add --exit-parse-config option, man page updates (minor formatting change)

Browse Source
This commit is contained in:
Michael Rash
2014-05-04 09:17:27 -04:00
parent d7e9ae578b
commit 02ed5f5ad4
9 changed files with 296 additions and 253 deletions
Download Patch File Download Diff File Expand all files Collapse all files
client/fwknop.8.in
+8 -2
View File
@@ -2,12 +2,12 @@
.\" Title: fwknop
.\" Author: [see the "AUTHORS" section]
.\" Generator: DocBook XSL Stylesheets v1.78.1 <http://docbook.sf.net/>
.\" Date: 01/02/2014
.\" Date: 05/04/2014
.\" Manual: Fwknop Client
.\" Source: Fwknop Client
.\" Language: English
.\"
.TH "FWKNOP" "8" "01/02/2014" "Fwknop Client" "Fwknop Client"
.TH "FWKNOP" "8" "05/04/2014" "Fwknop Client" "Fwknop Client"
.\" -----------------------------------------------------------------
.\" * Define some portability stuff
.\" -----------------------------------------------------------------
@@ -863,6 +863,12 @@ Specify the GPG home directory (\fI\-\-gpg\-home\-dir\fR)\&. Defaults to
\fI~/\&.gnupg\fR\&.
.RE
.PP
\fBGPG_EXE\fR \fI<path>\fR
.RS 4
Specify the path to GPG (\fI\-\-gpg\-exe\fR)\&. Defaults to
\fI/usr/bin/gpg\fR\&.
.RE
.PP
\fBSPOOF_USER\fR \fI<user>\fR
.RS 4
Set the username in the SPA data to the specified value (\fI\-U, \-\-spoof\-user\fR)\&.
doc/fwknop.man.asciidoc
+150 -150
View File
@@ -16,37 +16,37 @@ SYNOPSIS
DESCRIPTION
-----------
*fwknop* implements an authorization scheme known as Single Packet
Authorization (SPA) for strong service concealment. SPA requires only a single
Authorization (SPA) for strong service concealment. SPA requires only a single
packet which is encrypted, non-replayable, and authenticated via an HMAC in order
to communicate desired access to a service that is hidden behind a firewall in a
default-drop filtering stance. The main application of SPA is to use a
default-drop filtering stance. The main application of SPA is to use a
firewall to drop all attempts to connect to services such as 'SSH' in order
to make the exploitation of vulnerabilities (both 0-day and unpatched code)
more difficult. Any service that is concealed by SPA naturally cannot be
scanned for with 'Nmap'. The fwknop project supports three different
more difficult. Any service that is concealed by SPA naturally cannot be
scanned for with 'Nmap'. The fwknop project supports three different
firewalls: 'iptables' on Linux systems, 'pf' on OpenBSD, and 'ipfw' on FreeBSD
and Mac OS X.
SPA is essentially next generation Port Knocking (PK), but solves many of the
limitations exhibited by PK while retaining its core benefits. PK limitations
limitations exhibited by PK while retaining its core benefits. PK limitations
include a general difficulty in protecting against replay attacks, asymmetric
ciphers and HMAC schemes are not usually possible to reliably support, and it
is trivially easy to mount a DoS attack against a PK server just by spoofing an
additional packet into a PK sequence as it traverses the network (thereby convincing the
PK server that the client doesn't know the proper sequence). All of these
limitation are solved by SPA. At the same time, SPA hides services behind a
PK server that the client doesn't know the proper sequence). All of these
limitation are solved by SPA. At the same time, SPA hides services behind a
default-drop firewall policy, acquires SPA data passively (usually via
libpcap or other means), and implements standard cryptographic operations
for SPA packet authentication and encryption/decryption.
This is the manual page for the *fwknop* client which is responsible for
constructing SPA packets and sending them over the network. The server side is
constructing SPA packets and sending them over the network. The server side is
implemented by the *fwknopd* daemon which sniffs the network for SPA packets
and interacts with the local firewall to allow SPA authenticated connections.
It is recommended to read the 'fwknopd(8)' manual page as well.
SPA packets generated by *fwknop* leverage HMAC for authenticated encryption
in the encrypt-then-authenticate model. Although the usage of an HMAC is
in the encrypt-then-authenticate model. Although the usage of an HMAC is
currently optional (enabled via the *--use-hmac* command line switch), it is
highly recommended for three reasons: '1)' without an HMAC, cryptographically
strong authentication is not possible with *fwknop* unless GnuPG is used, but
@@ -56,22 +56,22 @@ as the Vaudenay attack and related trickery (like the more recent "Lucky 13"
attack against SSL), and '3)' the code required by the *fwknopd* daemon to
verify an HMAC is much more simplistic than the code required to decrypt an SPA
packet, so an SPA packet without a proper HMAC isn't even sent through the
decryption routines. Reason '3)' is why an HMAC should still be used even when
decryption routines. Reason '3)' is why an HMAC should still be used even when
SPA packets are encrypted with GnuPG due to the fact that SPA data is not sent
through *libgpgme* functions unless the HMAC checks out first. GnuPG and
through *libgpgme* functions unless the HMAC checks out first. GnuPG and
libgpgme are relatively complex bodies of code, and therefore limiting the
ability of a potential attacker to interact with this code through an HMAC
operation helps to maintain a stronger security stance. Generating an
operation helps to maintain a stronger security stance. Generating an
HMAC for SPA communications requires a dedicated key in addition to the normal
encryption key, and both can be generated with the *--key-gen* option.
*fwknop* encrypts SPA packets either with the 'Rijndael' block cipher or via
'GnuPG' and associated asymmetric cipher. If the symmetric encryption method
'GnuPG' and associated asymmetric cipher. If the symmetric encryption method
is chosen, then as usual the encryption key is shared between the client and
server (see the *fwknopd* '@sysconfdir@/fwknop/access.conf' file for details). The actual
server (see the *fwknopd* '@sysconfdir@/fwknop/access.conf' file for details). The actual
encryption key used for Rijndael encryption is generated via the standard
PBKDF1 key derivation algorithm, and CBC mode is set. If the GnuPG method
is chosen, then the encryption keys are derived from GnuPG key rings. SPA
PBKDF1 key derivation algorithm, and CBC mode is set. If the GnuPG method
is chosen, then the encryption keys are derived from GnuPG key rings. SPA
packets generated by fwknop running as a client adhere to the following
format (before encryption and the HMAC is applied):
@@ -88,14 +88,14 @@ format (before encryption and the HMAC is applied):
Each of the above fields are separated by a ":" character due to the variable
length of several of the fields, and those that might contain ":" characters
are base64 encoded. The message digest (*SHA256* by default) is part of the
are base64 encoded. The message digest (*SHA256* by default) is part of the
data to be encrypted and is independent of the HMAC which is appended to the
SPA packet data after encryption. The 16 digits of random data (about 53 bits)
SPA packet data after encryption. The 16 digits of random data (about 53 bits)
ensures that no two SPA packets are identical, and this is in addition to and
independent of using PBKDF1 for key derivation for Rijndael in CBC mode (which
uses an 8-byte random "salt" value). Because *fwknopd* tracks the SHA256
uses an 8-byte random "salt" value). Because *fwknopd* tracks the SHA256
digest of all incoming valid SPA packets and throws out duplicates, replay
attacks are not feasible against *fwknop*. Syslog alerts are generated if a
attacks are not feasible against *fwknop*. Syslog alerts are generated if a
replay is detected.
By default, the *fwknop* client sends authorization packets over UDP port
@@ -107,9 +107,9 @@ Also, *fwknop* can send the SPA packet over a random port via the
The *fwknop* client is quite portable, and is known to run on various Linux
distributions (all major distros and embedded ones such as OpenWRT as well),
FreeBSD, OpenBSD, and Cygwin on Windows. There is also a library *libfko*
FreeBSD, OpenBSD, and Cygwin on Windows. There is also a library *libfko*
that both *fwknop* and *fwknopd* use for SPA packet encryption/decryption
and HMAC authentication operations. This library can be used to allow
and HMAC authentication operations. This library can be used to allow
third party applications to use SPA subject to the terms of the GNU
Public License (GPL).
@@ -122,7 +122,7 @@ section below).
*-A, --access*='<port list>'::
Provide a list of ports and protocols to access on a remote computer
running *fwknopd*. The format of this list is
running *fwknopd*. The format of this list is
``+<proto>/<port>...<proto>/<port>+'', e.g. ``tcp/22,udp/53''. *NOTE:*
The vast majority of usages for *fwknop* require the *-A* argument, but
sending full commands with the *--server-cmd* argument via an SPA
@@ -136,14 +136,14 @@ section below).
*-R|-a|-s*::
One of these options (see below) is required to tell the remote
*fwknopd* daemon what IP should be allowed through the local firewall. It
*fwknopd* daemon what IP should be allowed through the local firewall. It
is recommend to use the *-R* or *-a* options instead of *-s* in order
to harden SPA communications against possible 'Man-In-The-Middle' (MITM)
attacks, and on the server side set 'REQUIRE_SOURCE_ADDRESS' variable in
the '@sysconfdir@/fwknop/access.conf' file. Note that the most secure
the '@sysconfdir@/fwknop/access.conf' file. Note that the most secure
option is *-a* so that *fwknop* does not have to issue an HTTP request to
'http://www.cipherdyne.org/cgi-bin/myip' in order to resolve the externally
routable IP address. Using *-a* requires that the user already knows what
routable IP address. Using *-a* requires that the user already knows what
the external IP is for the network where fwknop is running.
@@ -153,14 +153,14 @@ GENERAL OPTIONS
Print a usage summary message and exit.
*-G, --get-key*='<file>'::
Load an encryption key/password from the specified file. The key file
Load an encryption key/password from the specified file. The key file
contains a line for each destination hostname or IP address, a colon
(":"), optional space and the password, followed by a newline. Note
(":"), optional space and the password, followed by a newline. Note
that the last line has to have a terminating newline character.
Also note: though this is a convenience, having a file on your system
with clear text passwords is not a good idea and is not recommended.
Having the *fwknop* client prompt you for the key is generally more
secure. Note also that if a key is stored on disk, the *fwknop* rc
secure. Note also that if a key is stored on disk, the *fwknop* rc
file is a more powerful mechanism for specifying not only the key but
other options as well.
@@ -175,42 +175,42 @@ GENERAL OPTIONS
command line. A file descriptor set to 0 is similar to the stdin command.
*--get-hmac-key*='<file>'::
Load an HMAC key/password from the specified file. Similarly to the
Load an HMAC key/password from the specified file. Similarly to the
format for the *--get-key* option, the HMAC key file contains a line for
each destination hostname or IP address, a colon (":"), optional space
and the password, followed by a newline. Note that the last line has
to have a terminating newline character. Also note: though this is a
and the password, followed by a newline. Note that the last line has
to have a terminating newline character. Also note: though this is a
convenience, having a file on your system with clear text passwords is
not a good idea and is not recommended. Having the *fwknop* client
prompt you for the HMAC key is generally more secure. Note also that
not a good idea and is not recommended. Having the *fwknop* client
prompt you for the HMAC key is generally more secure. Note also that
if a key is stored on disk, the *fwknop* rc file is a more powerful
mechanism for specifying not only the HMAC key but other options as
well.
*--key-gen*::
Have *fwknop* generate both Rijndael and HMAC keys that can be used for SPA
packet encryption. These keys are derived from /dev/urandom and then base64
packet encryption. These keys are derived from /dev/urandom and then base64
encoded before being printed to stdout, and are meant to be included within
the ``$HOME/.fwknoprc'' file (or the file referenced by *--get-key*). Such
the ``$HOME/.fwknoprc'' file (or the file referenced by *--get-key*). Such
keys are generally more secure than passphrases that are typed in from the
command line.
*--key-len*='<length>'::
Specify the number of bytes for a generated Rijndael key. The maximum size
Specify the number of bytes for a generated Rijndael key. The maximum size
is currently 128 bytes.
*--hmac-key-len*='<length>'::
Specify the number of bytes for a generated HMAC key. The maximum size is
Specify the number of bytes for a generated HMAC key. The maximum size is
currently 128 bytes.
*-l, --last-cmd*::
Execute *fwknop* with the command-line arguments from the previous
invocation (if any). The previous arguments are parsed out of the
invocation (if any). The previous arguments are parsed out of the
'~/.fwknop.run' file.
*-n, --named-config*='<stanza name>'::
Specify the name of the configuration stanza in the ``$HOME/.fwknoprc''
file to pull configuration and command directives. These named stanzas
file to pull configuration and command directives. These named stanzas
alleviate the need for remembering the various command-line arguments
for frequently used invocations of *fwknop*. See the section labeled,
FWKNOPRC FILE below for a list of the valid configuration directives in
@@ -219,28 +219,28 @@ GENERAL OPTIONS
*--key-rijndael*='<key>'::
Specify the Rijndael key on the command line. Since the key may be visible
to utilities such as 'ps' under Unix, this form should only be used where
security is not critical. Having the *fwknop* client either prompt you for
security is not critical. Having the *fwknop* client either prompt you for
the key or acquire via the ``$HOME/.fwknoprc'' file is generally more
secure.
*--key-base64-rijndael*='<key>'::
Specify the base64 encoded Rijndael key. Since the key may be visible
to utilities such as 'ps' under Unix, this form should only be used where
security is not critical. Having the *fwknop* client either prompt you for
security is not critical. Having the *fwknop* client either prompt you for
the key or acquire via the ``$HOME/.fwknoprc'' file is generally more
secure.
*--key-base64-hmac*='<key>'::
Specify the base64 encoded HMAC key. Since the key may be visible
to utilities such as 'ps' under Unix, this form should only be used where
security is not critical. Having the *fwknop* client either prompt you for
security is not critical. Having the *fwknop* client either prompt you for
the key or acquire via the ``$HOME/.fwknoprc'' file is generally more
secure.
*--key-hmac*='<key>'::
Specify the raw HMAC key (not base64 encoded). Since the key may be visible
to utilities such as 'ps' under Unix, this form should only be used where
security is not critical. Having the *fwknop* client either prompt you for
security is not critical. Having the *fwknop* client either prompt you for
the key or acquire via the ``$HOME/.fwknoprc'' file is generally more
secure.
@@ -249,7 +249,7 @@ GENERAL OPTIONS
*--save-rc-stanza*='<stanza name>'::
Save command line arguments to the $HOME/.fwknoprc stanza specified with
the *-n* option. If the *-n* option is omitted, then the stanza name will
the *-n* option. If the *-n* option is omitted, then the stanza name will
default to the destination server value (hostname or IP) given with the
*-D* argument.
@@ -264,7 +264,7 @@ GENERAL OPTIONS
Display the last command-line arguments used by *fwknop*.
*-E, --save-args-file*='<file>'::
Save command line arguments to a specified file path. Without this
Save command line arguments to a specified file path. Without this
option, and when *--no-save-args* is not also specified, then the default
save args path is '~/.fwknop.run'.
@@ -272,7 +272,7 @@ GENERAL OPTIONS
Do not save the command line arguments given when *fwknop* is executed.
*-T, --test*::
Test mode. Generate the SPA packet data, but do not send it. Instead,
Test mode. Generate the SPA packet data, but do not send it. Instead,
print a break-down of the SPA data fields, then run the data through
the decryption and decoding process and print the break-down again.
This is primarily a debugging feature.
@@ -286,7 +286,7 @@ GENERAL OPTIONS
option.
*-v, --verbose*::
Run the *fwknop* client in verbose mode. This causes *fwknop* to print
Run the *fwknop* client in verbose mode. This causes *fwknop* to print
some extra information about the current command and the resulting SPA
data.
@@ -297,21 +297,21 @@ GENERAL OPTIONS
SPA OPTIONS
-----------
*--use-hmac*::
Set HMAC mode for authenticated encryption of SPA communications. As of
Set HMAC mode for authenticated encryption of SPA communications. As of
*fwknop* 2.5, this is an optional feature, but this will become the
default in a future release.
*-a, --allow-ip*='<IP-address>'::
Specify IP address that should be permitted through the destination
*fwknopd* server firewall (this IP is encrypted within the SPA packet
itself). This is useful to prevent a MITM attack where a SPA packet
itself). This is useful to prevent a MITM attack where a SPA packet
can be intercepted en-route and sent from a different IP than the
original. Hence, if the *fwknopd* server trusts the source address
original. Hence, if the *fwknopd* server trusts the source address
on the SPA packet IP header then the attacker gains access.
The *-a* option puts the source address within the encrypted SPA
packet, and so thwarts this attack. The *-a* option is also
packet, and so thwarts this attack. The *-a* option is also
useful to specify the IP that will be granted access when the
SPA packet itself is spoofed with the *--spoof-src* option. Another
SPA packet itself is spoofed with the *--spoof-src* option. Another
related option is *-R* (see below) which instructs the *fwknop* client
to automatically resolve the externally routable IP address the local
system is connected to by querying a website that returns the actual
@@ -329,74 +329,74 @@ SPA OPTIONS
*-N, --nat-access*='<internalIP:forwardPort>'::
The *fwknopd* server offers the ability to provide SPA access through
an iptables firewall to an internal service by interfacing with the
iptables NAT capabilities. So, if the *fwknopd* server is protecting
iptables NAT capabilities. So, if the *fwknopd* server is protecting
an internal network on an RFC-1918 address space, an external *fwknop*
client can request that the server port forward an external port to an
internal IP, i.e. ``+--NAT-access 192.168.10.2,55000+''. In this case,
internal IP, i.e. ``+--NAT-access 192.168.10.2,55000+''. In this case,
access will be granted to 192.168.10.2 via port 55000 to whatever
service is requested via the *--access* argument (usually tcp/22).
Hence, after sending such an SPA packet, one would then do
``ssh -p 55000 user@host'' and the connection would be forwarded on
through to the internal 192.168.10.2 system automatically. Note that
through to the internal 192.168.10.2 system automatically. Note that
the port ``55000'' can be randomly generated via the *--nat-rand-port*
argument (described later).
*--nat-local*::
On the *fwknopd* server, a NAT operation can apply to the local system
instead of being forwarded through the system. That is, for iptables
instead of being forwarded through the system. That is, for iptables
firewalls, a connection to, say, port 55,000 can be translated to port
22 on the local system. By making use of the *--nat-local* argument,
the *fwknop* client can be made to request such access. This means
22 on the local system. By making use of the *--nat-local* argument,
the *fwknop* client can be made to request such access. This means
that any external attacker would only see a connection over port 55,000
instead of the expected port 22 after the SPA packet is sent.
*--nat-port*::
Usually *fwknop* is used to request access to a specific port such as
tcp/22 on a system running *fwknopd*. However, by using the *--nat-port*
tcp/22 on a system running *fwknopd*. However, by using the *--nat-port*
argument, it is possible to request access to a (again, such as tcp/22),
but have this access granted via the specified port (so, the *-p* argument
would then be used on the 'SSH' client command line). See the
would then be used on the 'SSH' client command line). See the
*--nat-local* and *--nat-access* command line arguments to *fwknop* for
additional details on gaining access to services via a NAT operation.
*--nat-rand-port*::
Usually *fwknop* is used to request access to a specific port such as
tcp/22 on a system running *fwknopd*. However, by using the
tcp/22 on a system running *fwknopd*. However, by using the
*--nat-rand-port* argument, it is possible to request access to a
particular service (again, such as tcp/22), but have this access
granted via a random translated port. That is, once the *fwknop*
granted via a random translated port. That is, once the *fwknop*
client has been executed in this mode and the random port selected
by *fwknop* is displayed, the destination port used by the follow-on
client must be changed to match this random port. For 'SSH', this is
accomplished via the *-p* argument. See the *--nat-local* and
client must be changed to match this random port. For 'SSH', this is
accomplished via the *-p* argument. See the *--nat-local* and
*--nat-access* command line arguments to *fwknop* for additional
details on gaining access to services via a NAT operation.
*-p, --server-port*='<port>'::
Specify the port number where *fwknopd* accepts packets via libpcap or
ulogd pcap writer. By default *fwknopd* looks for authorization packets
ulogd pcap writer. By default *fwknopd* looks for authorization packets
over UDP port 62201.
*-P, --server-proto*='<protocol>'::
Set the protocol (udp, tcp, http, udpraw, tcpraw, or icmp) for the outgoing
SPA packet. Note: The *udpraw*, *tcpraw*, and *icmp* modes use raw sockets
and thus require root access to run. Also note: The *tcp* mode expects to
SPA packet. Note: The *udpraw*, *tcpraw*, and *icmp* modes use raw sockets
and thus require root access to run. Also note: The *tcp* mode expects to
establish a TCP connection to the server before sending the SPA packet.
This is not normally done, but is useful for compatibility with the Tor for
strong anonymity; see 'http://tor.eff.org/'. In this case, the
strong anonymity; see 'http://tor.eff.org/'. In this case, the
*fwknopd* server will need to be configured to listen on the target TCP
port (which is 62201 by default).
*-Q, --spoof-src*='<IP>'::
Spoof the source address from which the *fwknop* client sends SPA
packets. This requires root on the client side access since a raw
socket is required to accomplish this. Note that the *--spoof-user*
packets. This requires root on the client side access since a raw
socket is required to accomplish this. Note that the *--spoof-user*
argument can be given in this mode in order to pass any *REQUIRE_USERNAME*
keyword that might be specified in '@sysconfdir@/fwknop/access.conf'.
*-r, --rand-port*::
Instruct the *fwknop* client to send an SPA packet over a random
destination port between 10,000 and 65535. The *fwknopd* server must
destination port between 10,000 and 65535. The *fwknopd* server must
use a *PCAP_FILTER* variable that is configured to accept such packets.
For example, the *PCAP_FILTER* variable could be set to: ``+udp dst
portrange 10000-65535+''.
@@ -406,10 +406,10 @@ SPA OPTIONS
the *fwknopd* daemon/service to query a web server that returns the
caller's IP address (as seen by the web server). In some cases, this is
needed to determine the IP address that should be allowed through the
iptables policy at the remote fwknopd server side. This is useful if
iptables policy at the remote fwknopd server side. This is useful if
the *fwknop* client is being used on a system that is behind an obscure
NAT address. Presently, *fwknop* uses the URL:
'http://www.cipherdyne.org/cgi-bin/myip' to resolve the caller IP. Note
'http://www.cipherdyne.org/cgi-bin/myip' to resolve the caller IP. Note
that it is generally more secure to use the *-a* option if the externally
routable IP address for the client is already known to the user since this
elminates the need for *fwknop* to issue an HTTP request.
@@ -424,9 +424,9 @@ SPA OPTIONS
special-case IP address ``+0.0.0.0+'' which will inform the destination
*fwknopd* SPA server to use the source IP address from which the
SPA packet originates as the IP that will be allowed through upon
modification of the firewall ruleset. This option is useful if the
modification of the firewall ruleset. This option is useful if the
*fwknop* client is deployed on a machine that is behind a NAT device and
the external IP is not known. However, usage of this option is not
the external IP is not known. However, usage of this option is not
recommended, and either the *-a* or *-R* options should be used instead.
The permit-address options *-s*, *-R* and *-a* are mutually
exclusive.
@@ -436,7 +436,7 @@ SPA OPTIONS
*-f, --fw-timeout*='<seconds>'::
Specify the length of time (seconds) that the remote firewall rule that
grants access to a service is to remain active. The default maintained by
grants access to a service is to remain active. The default maintained by
*fwknopd* is 30 seconds, but any established connection can be kept open
after the initial accept rule is deleted through the use of a connection
tracking mechanism that may be offered by the firewall.
@@ -444,38 +444,38 @@ SPA OPTIONS
*-C, --server-cmd*='<command to execute>'::
Instead of requesting access to a service with an SPA packet, the
*--server-cmd* argument specifies a command that will be executed by
the *fwknopd* server. The command is encrypted within the SPA packet
the *fwknopd* server. The command is encrypted within the SPA packet
and sniffed off the wire (as usual) by the *fwknopd* server.
*-H, --http-proxy*='<proxy-host>[:port]'::
Specify an HTTP proxy that the *fwknop* client will use to send the SPA
packet through. Using this option will automatically set the SPA packet
packet through. Using this option will automatically set the SPA packet
transmission mode (usually set via the *--server-proto* argument) to
"http". You can also specify the proxy port by adding ":<port>" to
"http". You can also specify the proxy port by adding ":<port>" to
the proxy host name or ip.
*-m, --digest-type*='<digest>'::
Specify the message digest algorithm to use in the SPA data. Choices
Specify the message digest algorithm to use in the SPA data. Choices
are: *MD5*, *SHA1*, *SHA256* (the default), *SHA384*, and *SHA512*.
*-M, --encryption-mode*='<mode>'::
Specify the encryption mode when AES is used for encrypting SPA packets.
The default is CBC mode, but others can be chosen such as CFB or OFB
as long as this is also specified in the '@sysconfdir@/fwknop/access.conf' file on the
server side via the ENCRYPTION_MODE variable. In general, it is
server side via the ENCRYPTION_MODE variable. In general, it is
recommended to not include this argument and let the default (CBC) apply.
Note that the string ``legacy'' can be specified in order to generate SPA
packets with the old initialization vector strategy used by versions of
*fwknop* prior to 2.5. With the 2.5 release, *fwknop* generates
*fwknop* prior to 2.5. With the 2.5 release, *fwknop* generates
initialization vectors in a manner that is compatible with OpenSSL via the
PBKDF1 algorithm.
*--time-offset-plus*='<time>'::
By default, the *fwknopd* daemon on the server side enforces time
synchronization between the clocks running on client and server
systems. The *fwknop* client places the local time within each SPA
systems. The *fwknop* client places the local time within each SPA
packet as a time stamp to be validated by the fwknopd server after
decryption. However, in some circumstances, if the clocks are out
decryption. However, in some circumstances, if the clocks are out
of sync and the user on the client system does not have the required
access to change the local clock setting, it can be difficult to
construct and SPA packet with a time stamp the server will accept.
@@ -493,24 +493,24 @@ SPA OPTIONS
sending SPA packets over HTTP.
*-U, --spoof-user*='<user>'::
Specify the username that is included within SPA packet. This allows
Specify the username that is included within SPA packet. This allows
the *fwknop* client to satisfy any non-root *REQUIRE_USERNAME* keyword
on the fwknopd server (*--spoof-src* mode requires that the *fwknop*
client is executed as root).
*--icmp-type*='<type>'::
In *-P icmp* mode, specify the ICMP type value that will be set in the
SPA packet ICMP header. The default is echo reply.
SPA packet ICMP header. The default is echo reply.
*--icmp-code*='<code>'::
In *-P icmp* mode, specify the ICMP code value that will be set in the
SPA packet ICMP header. The default is zero.
SPA packet ICMP header. The default is zero.
GPG OPTIONS
-----------
Note that the usage of GPG for SPA encryption/decryption can and should involve
GPG keys that are signed by each side (client and server). The basic procedure
GPG keys that are signed by each side (client and server). The basic procedure
for this involves the following steps after the client key has been transferred
to the server and vice-versa:
@@ -534,43 +534,43 @@ More comprehensive information on this can be found here:
*--gpg-home-dir*='<dir>'::
Specify the path to the GnuPG directory; normally this path is derived
from the home directory of the user that is running the *fwknop*
client (so the default is '~/.gnupg'). This is useful when a ``root''
client (so the default is '~/.gnupg'). This is useful when a ``root''
user wishes to log into a remote machine whose sshd daemon/service does not
permit root login.
*--gpg-recipient*='<key ID or Name>'::
Specify the GnuPG key ID, e.g. ``+1234ABCD+'' (see the output of
"gpg--list-keys") or the key name (associated email address) of the
recipient of the Single Packet Authorization message. This key is
recipient of the Single Packet Authorization message. This key is
imported by the *fwknopd* server and the associated private key is used
to decrypt the SPA packet. The recipient’s key must first be imported
to decrypt the SPA packet. The recipient’s key must first be imported
into the client GnuPG key ring.
*--gpg-signer-key*='<key ID or Name>'::
Specify the GnuPG key ID, e.g. ``+ABCD1234+'' (see the output of
"gpg --list-keys") or the key name to use when signing the SPA message.
The user is prompted for the associated GnuPG password to create the
signature. This adds a cryptographically strong mechanism to allow
signature. This adds a cryptographically strong mechanism to allow
the *fwknopd* daemon on the remote server to authenticate who created
the SPA message.
*--gpg-no-signing-pw*::
Instruct *fwknop* to not acquire a passphrase for usage of GnuPG signing
key. This option is provided to make SPA packet construction easier for
key. This option is provided to make SPA packet construction easier for
client-side operations in automated environments where the passphrase for
the signing key has been removed from the GnuPG key ring. However, it is
the signing key has been removed from the GnuPG key ring. However, it is
usually better to leverage 'gpg-agent' instead of using this option.
FWKNOPRC FILE
-------------
The '.fwknoprc' file is used to set various parameters to override default
program parameters at runtime. It also allows for additional named
program parameters at runtime. It also allows for additional named
configuration 'stanzas' for setting program parameters for a particular
invocation.
The *fwknop* client will create this file if it does not exist in the user's
home directory. This initial version has some sample directives that are
commented out. It is up to the user to edit this file to meet their needs.
home directory. This initial version has some sample directives that are
commented out. It is up to the user to edit this file to meet their needs.
The '.fwknoprc' file contains a default configuration area or stanza which
holds global configuration directives that override the program defaults.
@@ -581,7 +581,7 @@ Note that command-line options will still override any corresponding
'.fwknoprc' directives.
There are directives to match most of the command-line parameters *fwknop*
supports. Here is the current list of each directive along with a brief
supports. Here is the current list of each directive along with a brief
description and its matching command-line option(s):
*SPA_SERVER* '<hostname/IP-address>'::
@@ -589,8 +589,8 @@ description and its matching command-line option(s):
('-D, --destination').
*ALLOW_IP* '<IP-address>'::
Specify the address to allow within the SPA data. Note: This parameter
covers the *-a*, *-s*, and *-R* command-line options. You can specify
Specify the address to allow within the SPA data. Note: This parameter
covers the *-a*, *-s*, and *-R* command-line options. You can specify
a hostname or IP address (the *-a* option), specify the word "source" to
tell the *fwknopd* server to accept the source IP of the packet as the IP
to allow (the *-s* option), or use the word "resolve" to have *fwknop*
@@ -608,32 +608,32 @@ description and its matching command-line option(s):
*KEY* '<passphrase>'::
This is the passphrase that is used for SPA packet encryption and applies
to both Rijndael or GPG encryption modes. The actual encryption key that
to both Rijndael or GPG encryption modes. The actual encryption key that
is used for Rijndael is derived from the PBKDF1 algorithm, and the GPG key
is derived from the specified GPG key ring.
*KEY_BASE64* '<base64 encoded passphrase>'::
Specify the encryption passphrase as a base64 encoded string. This allows
Specify the encryption passphrase as a base64 encoded string. This allows
non-ascii characters to be included in the base64-decoded key.
*USE_HMAC* '<Y/N>'::
Set HMAC mode for authenticated encryption of SPA packets. This will have
Set HMAC mode for authenticated encryption of SPA packets. This will have
*fwknop* prompt the user for a dedicated HMAC key that is independent of
the encryption key. Alternatively, the HMAC key can be specified with the
the encryption key. Alternatively, the HMAC key can be specified with the
'HMAC_KEY' or 'HMAC_KEY_BASE64' directives (see below).
*HMAC_KEY* '<key>'::
Specify the HMAC key for authenticated encryption of SPA packets. This
Specify the HMAC key for authenticated encryption of SPA packets. This
supports both Rijndael and GPG encryption modes, and is applied according
to the encrypt-then-authenticate model.
*HMAC_KEY_BASE64* '<base64 encoded key>'::
Specify the HMAC key as a base64 encoded string. This allows non-ascii
Specify the HMAC key as a base64 encoded string. This allows non-ascii
characters to be included in the base64-decoded key.
*HMAC_DIGEST_TYPE* '<digest algorithm>'::
Set the HMAC digest algorithm used for authenticated encryption of SPA
packets. Choices are: *MD5*, *SHA1*, *SHA256* (the default), *SHA384*,
packets. Choices are: *MD5*, *SHA1*, *SHA256* (the default), *SHA384*,
and *SHA512*.
*SPA_SOURCE_PORT* '<port>'::
@@ -647,19 +647,19 @@ description and its matching command-line option(s):
(--resolve-url).
*TIME_OFFSET* '<time>'::
Set a value to apply to the timestamp in the SPA packet. This can
Set a value to apply to the timestamp in the SPA packet. This can
be either a positive or negative value ('--time-offset-plus/minus').
*ENCRYPTION_MODE* '<mode>'::
Specify the encryption mode when AES is used. This variable is a synonym
for the '-M, --encryption-mode' command line argument. In general, it is
Specify the encryption mode when AES is used. This variable is a synonym
for the '-M, --encryption-mode' command line argument. In general, it is
recommended to not include this argument and let the default (CBC) apply.
Note that the string ``legacy'' can be specified in order to generate SPA
packets with the old initialization vector strategy used by versions of
*fwknop* prior to 2.5.
*DIGEST_TYPE* '<digest algorithm>'::
Set the SPA message digest type ('-m, --digest-type'). Choices are: *MD5*,
Set the SPA message digest type ('-m, --digest-type'). Choices are: *MD5*,
*SHA1*, *SHA256* (the default), *SHA384*, and *SHA512*.
*USE_GPG* '<Y/N>'::
@@ -667,18 +667,18 @@ description and its matching command-line option(s):
*USE_GPG_AGENT* '<Y/N>'::
Set to 'Y' to have *fwknop* interface with a GPG agent instance for the GPG
key password ('--gpg-agent'). Agent information itself is specified with
key password ('--gpg-agent'). Agent information itself is specified with
the 'GPG_AGENT_INFO' environmental variable.
*GPG_SIGNING_PW* '<passphrase>'::
This is the passphrase that is used for signing SPA packet data in GPG
encryption mode, and is a synonym for the 'KEY' variable (i.e. the signing
passphrase can be specified with the 'KEY' variable instead). The SPA
passphrase can be specified with the 'KEY' variable instead). The SPA
packet is encrypted with the remote server key and signed with the local
client key.
*GPG_SIGNING_PW_BASE64* '<base64 encoded passphrase>'::
Specify the GPG signing passphrase as a base64 encoded string. This allows
Specify the GPG signing passphrase as a base64 encoded string. This allows
non-ascii characters to be included in the base64-decoded key.
*GPG_SIGNER* '<key ID or Name>'::
@@ -690,10 +690,10 @@ description and its matching command-line option(s):
data ('--gpg-recipient-key').
*GPG_HOMEDIR* '<dir>'::
Specify the GPG home directory ('--gpg-home-dir'). Defaults to '~/.gnupg'.
Specify the GPG home directory ('--gpg-home-dir'). Defaults to '~/.gnupg'.
*GPG_EXE* '<path>'::
Specify the path to GPG ('--gpg-exe'). Defaults to '/usr/bin/gpg'.
Specify the path to GPG ('--gpg-exe'). Defaults to '/usr/bin/gpg'.
*SPOOF_USER* '<user>'::
Set the username in the SPA data to the specified value ('-U,
@@ -738,11 +738,11 @@ SPA PACKET SPOOFING
Because *fwknop* places the IP to be allowed through the firewall within the
encrypted SPA payload (unless *-s* is used which is not recommended and can be
prohibited in the *fwknopd* server configuration), SPA packets can easily be
spoofed, and this is a good thing in this context. That is, the source IP of
spoofed, and this is a good thing in this context. That is, the source IP of
an SPA packet is ignored by the *fwknopd* daemon (when the 'REQUIRE_SOURCE_ADDRESS'
variable is set in the '@sysconfdir@/fwknop/access.conf' file) and only the IP that is
contained within an authenticated and properly decrypted SPA packet is granted
access through the firewall. This makes it possible to make it appear as
access through the firewall. This makes it possible to make it appear as
though, say, www.yahoo.com is trying to authenticate to a target system but in
reality the actual connection will come from a seemingly unrelated IP.
@@ -756,8 +756,8 @@ Quick start
~~~~~~~~~~~
The most effective and easiest way to use *fwknop* is to have the client
generate both an encryption key and an HMAC key, and then save them to the
``$HOME/.fwknoprc'' file along with access request specifics. The keys will
also need to be transferred to the system where *fwknopd* is running. The
``$HOME/.fwknoprc'' file along with access request specifics. The keys will
also need to be transferred to the system where *fwknopd* is running. The
also client supports a separate set of encryption and HMAC keys for each SPA
destination if multiple fwknopd servers are running on different systems.
@@ -772,8 +772,8 @@ run the client like so to generate encryption and HMAC keys:
With the access request arguments and encryption and HMAC keys generated and saved
in ``$HOME/.fwknoprc'', the keys themselves need to be transferred to the '2.2.2.2'
system where fwknopd is running. As always, this should be done via some secure
means such as SSH before SPA is enabled and SSHD is blocked by the firewall. Here
system where fwknopd is running. As always, this should be done via some secure
means such as SSH before SPA is enabled and SSHD is blocked by the firewall. Here
is what the new '2.2.2.2' stanza looks like in the '~/.fwknoprc' file:
..........................
@@ -790,9 +790,9 @@ is what the new '2.2.2.2' stanza looks like in the '~/.fwknoprc' file:
The keys are base64 encoded blobs of random data, and both the *KEY_BASE64* and
*HMAC_KEY_BASE64* lines should be copied verbatim and placed within the
'@sysconfdir@/fwknop/access.conf' file on '2.2.2.2'. Once this is done, *fwknopd*
'@sysconfdir@/fwknop/access.conf' file on '2.2.2.2'. Once this is done, *fwknopd*
can be started on that system, a default-drop policy against SSH connections can
be put in place, and then access to SSH is managed via fwknop. To access SSH,
be put in place, and then access to SSH is managed via fwknop. To access SSH,
just use the *-n* argument to reference the '2.2.2.2' stanza out of the .fwknoprc
file (some *--verbose* output is included for illustration):
@@ -825,13 +825,13 @@ Access mode examples
~~~~~~~~~~~~~~~~~~~~
The most common usage of *fwknop* is to gain access to SSH running on a
remote system that has the *fwknopd* daemon deployed along with a default-drop
firewall policy. The following command illustrates this where IP '1.1.1.1' is
firewall policy. The following command illustrates this where IP '1.1.1.1' is
the IP to be allowed through the firewall running on '3.3.3.3' (note that the
'@sysconfdir@/fwknop/access.conf' file consumed by *fwknopd* will need to have matching encryption
and HMAC keys, and configuration specifics can be found in the 'fwknopd(8)'
manual page). Also, note the examples below prompt the user to supply the
manual page). Also, note the examples below prompt the user to supply the
encryption and HMAC keys via stdin instead of writing them to disk as in the
case of using the ``$HOME/.fwknoprc'' file in the example above. However, all
case of using the ``$HOME/.fwknoprc'' file in the example above. However, all
of the following examples can be converted to using the ~/.fwknoprc file just by
adding the *--save-rc-stanza* argument:
@@ -874,10 +874,10 @@ example of requesting access to both 'SSH' and 'OpenVPN' on '3.3.3.3':
..........................
There are many cases where an *fwknop* client is deployed on a network behind
a NAT device and the externally routable IP is not known to the user. In this
a NAT device and the externally routable IP is not known to the user. In this
case, use the IP resolution service available at
'http://www.cipherdyne.org/cgi-bin/myip' via the *-R* command line switch in
order to derive the external client IP address. This is a safer method of
order to derive the external client IP address. This is a safer method of
acquiring the client IP address than using the *-s* option mentioned earlier
in this manual page because the source IP is put within the encrypted packet
instead of having the *fwknopd* daemon grant the requested access from whatever
@@ -908,7 +908,7 @@ it, it is possible to take advantage of the NAT capabilities offered by
iptables in order to transparently reach systems behind the firewall via SPA.
Here is an example where the *fwknop* client is used to gain access to SSH
running on the non-routable IP '192.168.10.23' that is deployed on the network
behind '3.3.3.3'. In this case, the SSH connection made to '3.3.3.3' is
behind '3.3.3.3'. In this case, the SSH connection made to '3.3.3.3' is
translated via NAT to the '192.168.10.2' system automatically:
..........................
@@ -922,20 +922,20 @@ With the '2.5' release, *fwknop* underwent significant changes in its usage of
cryptography including the addition of support for HMAC authenticated encryption
for both Rijndael and GnuPG modes, ensuring the proper usage of PBKDF1 for key
derivation when SPA packets are encrypted with Rijndael, and several bugs were
fixed from previous versions of fwknop. In general, this implies that when
fixed from previous versions of fwknop. In general, this implies that when
Rijndael is used, SPA packets produced by the '2.5' release are incompatible
with previous versions of fwknop. The GnuPG encryption mode is unaffected by
these updates. However, even with Rijndael is used, backwards compatibility is
with previous versions of fwknop. The GnuPG encryption mode is unaffected by
these updates. However, even with Rijndael is used, backwards compatibility is
supported through setting the 'legacy' encryption mode with
*-M* on the fwknop client command line and/or the 'ENCRYPTION_MODE' variable in
the '@sysconfdir@/fwknop/access.conf' file. This way, a pre-2.5 server can
the '@sysconfdir@/fwknop/access.conf' file. This way, a pre-2.5 server can
decrypt SPA packets produced by a 2.5 and later client (set '-M legacy'), and
a 2.5 and later server can decrypt SPA packets produced by pre-2.5 clients (set
'ENCRYPTION_MODE legacy' in the access.conf file). Note that HMAC is only
'ENCRYPTION_MODE legacy' in the access.conf file). Note that HMAC is only
supported as of 2.5 and is an optional feature, so backwards compatibility is
only for configurations that don't use an HMAC on either side. It is strongly
only for configurations that don't use an HMAC on either side. It is strongly
recommended to upgrade all fwknop clients and servers to 2.5 and use the new
HMAC mode for properly authenticated SPA communications. The backwards
HMAC mode for properly authenticated SPA communications. The backwards
compatibility support is used to make it easier to upgrade clients and servers
with a phased approach.
@@ -949,7 +949,7 @@ the '@sysconfdir@/fwknop/access.conf' file, add the following line:
In addition, if the 'KEY' variable has an encryption key longer than 16 bytes,
it will need to be truncated to 16 characters in the 'access.conf' file in
order for pre-2.5 clients to work properly. This limitation is fixed in 2.5,
order for pre-2.5 clients to work properly. This limitation is fixed in 2.5,
and provides additional motiviation for upgrading all clients and servers to
2.5 or later.
@@ -966,9 +966,9 @@ DEPENDENCIES
------------
The *fwknop* client requires 'libfko' which is normally included with both source
and binary distributions, and is a dedicated library developed by the fwknop
project. Whenever the *fwknopd* server is used, 'libpcap' is a required dependency.
project. Whenever the *fwknopd* server is used, 'libpcap' is a required dependency.
However, the upcoming '2.6' release will offer a UDP listener mode along with
privilege separation support and will not require libpcap in this mode. In UDP
privilege separation support and will not require libpcap in this mode. In UDP
listener mode, even though fwknopd binds to a UDP port, SPA packets are never
acknowledged so from an attacker's perspective there is no difference between
fwknopd sniffing the wire passively vs. listening on a UDP socket in terms of
@@ -986,13 +986,13 @@ DIAGNOSTICS
-----------
The most comprehensive way to gain diagnostic information on *fwknop* is to run
the test suite 'test-fwknop.pl' script located in the 'test/' directory in the fwknop
sources. The test suite sends fwknop through a large number of run time
sources. The test suite sends fwknop through a large number of run time
tests, has 'valgrind' support, validates both SPA encryption and HMAC results
against OpenSSL, and even has its own built in fuzzer for SPA communications.
For more basic diagnostic information, *fwknop* can be executed with the *-T*
(or *--test*) command line option. This will have *fwknop* simply create and
(or *--test*) command line option. This will have *fwknop* simply create and
print the SPA packet information, then run it through a decrypt/decode cycle
and print it again. In addition, the *--verbose* command line switch is useful
and print it again. In addition, the *--verbose* command line switch is useful
to see various SPA packet specifics printed to stdout.
@@ -1002,9 +1002,9 @@ fwknopd(8), iptables(8), pf(4), pfctl(8), ipfw(8), gpg(1), libfko documentation.
More information on Single Packet Authorization can be found in the paper
``Single Packet Authorization with fwknop'' available at
'http://www.cipherdyne.org/fwknop/docs/SPA.html'. A comprehensive tutorial
'http://www.cipherdyne.org/fwknop/docs/SPA.html'. A comprehensive tutorial
on *fwknop* operations and theory can be found at
'http://www.cipherdyne.org/fwknop/docs/fwknop-tutorial.html'. This tutorial
'http://www.cipherdyne.org/fwknop/docs/fwknop-tutorial.html'. This tutorial
also includes information about the design of *fwknop* that may be worth
reading for those interested in why fwknop is different from other SPA
implementations.
@@ -1029,9 +1029,9 @@ CONTRIBUTORS
------------
This ``C'' version of fwknop was derived from the original Perl-based version
on which many people who are active in the open source community have
contributed. See the CREDITS file in the fwknop sources, or visit
contributed. See the CREDITS file in the fwknop sources, or visit
'http://www.cipherdyne.org/fwknop/docs/contributors.html' to view the online
list of contributors. A few contributors deserve to be singled out including:
list of contributors. A few contributors deserve to be singled out including:
Franck Joncourt, Max Kastanas, Vlad Glagolev, Sean Greven, Hank Leininger,
Fernando Arnaboldi, and Erik Gomez.
@@ -1041,8 +1041,8 @@ Nomad at the BlackHat Briefings of 2005.
BUGS
----
Send bug reports to dstuart@dstuart.org or mbr@cipherdyne.org, or open a new
issue on Github (see 'https://github.com/mrash/fwknop.git'). Suggestions
and/or comments are always welcome as well. Additional information may be
issue on Github (see 'https://github.com/mrash/fwknop.git'). Suggestions
and/or comments are always welcome as well. Additional information may be
found in the *fwknop* mailing list archives (see:
'https://lists.sourceforge.net/lists/listinfo/fwknop-discuss').
doc/fwknopd.man.asciidoc
+109 -99
View File
@@ -25,12 +25,12 @@ configurable timeout.
The main application of this program is to conceal services such as 'SSH'
with an additional layer of security in order to make the exploitation of
vulnerabilities (both 0-day and unpatched code) much more difficult. In
vulnerabilities (both 0-day and unpatched code) much more difficult. In
addition, services that are concealed in this fashion naturally cannot be
scanned for with 'Nmap'.
The main configuration for *fwknopd* is maintained within two files:
'fwknopd.conf' and 'access.conf'. The default location for these files
'fwknopd.conf' and 'access.conf'. The default location for these files
is determined at package configuration (typically '@sysconfdir@/fwknop').
The configuration variables within these files are described below.
@@ -38,7 +38,7 @@ The configuration variables within these files are described below.
COMMAND-LINE OPTIONS
--------------------
*-i, --interface*='<interface>'::
Manually specify interface on which to sniff, e.g. ``-i eth0''. This
Manually specify interface on which to sniff, e.g. ``-i eth0''. This
option is not usually needed because the ``PCAP_INTF'' keyword in the
'fwknopd.conf' file defines the sniffing interface.
@@ -52,12 +52,12 @@ COMMAND-LINE OPTIONS
and then exit.
*-a, --access-file*='<access-file>'::
Specify the location of the 'access.conf' file. If this option is
Specify the location of the 'access.conf' file. If this option is
not given, 'fwknopd' will use the compile-time default location (typically
'@sysconfdir@/fwknop/access.conf').
*-c, --config*='<config-file>'::
Specify the location of the 'fwknopd.conf' file. If this option is
Specify the location of the 'fwknopd.conf' file. If this option is
not given, 'fwknopd' will use the default location (typically
'@sysconfdir@/fwknop/fwknopd.conf'.
@@ -66,7 +66,7 @@ COMMAND-LINE OPTIONS
this limit is reached.
*-d, --digest-file*='<digest-file>'::
Specify the location of the 'digest.cache' file. If this option is
Specify the location of the 'digest.cache' file. If this option is
not given, 'fwknopd' will use the compile-time default location (typically
'@localstatedir@/run/fwknop/digest.cache').
@@ -74,19 +74,29 @@ COMMAND-LINE OPTIONS
Dump the configuration values that *fwknopd* derives from the
'@sysconfdir@/fwknop/fwknopd.conf'' (or override files) and '@sysconfdir@/fwknop/access.conf' on stderr.
*--dump-serv-err-codes*::
Dump all possible *fwknopd* error codes to stdout and exit. This option is
rarely needed in practice, and was added to assist with test coverage.
*--fw-list-all*::
List all firewall rules including those that have nothing to do with
*fwknopd*.
*--fw-flush*::
Flush any firewall rules created by a running *fwknopd* process. This
Flush any firewall rules created by a running *fwknopd* process. This
option allows the used to easily delete *fwknopd* firewall rules without
having to wait for them to be timed out.
*-K, --kill*::
Kill the current *fwknopd* process. This provides a quick and easy
Kill the current *fwknopd* process. This provides a quick and easy
way to stop *fwknopd* without having to look in the process table.
*--exit-parse-config*::
Parse config files ('@sysconfdir@/fwknop/fwknopd.conf', '@sysconfdir@/fwknop/access.conf',
the digest cache file, etc.) and exit. This provides a way to test whether
the config files are properly structured without having to start processing
network traffic.
*-l, --locale*='<locale>'::
Set/override the system default locale setting.
@@ -97,51 +107,51 @@ COMMAND-LINE OPTIONS
*-O, --override-config*='<file>'::
Override config variable values that are normally read from the
'@sysconfdir@/fwknop/fwknopd.conf'' file with values from the specified file. Multiple
'@sysconfdir@/fwknop/fwknopd.conf'' file with values from the specified file. Multiple
override config files can be given as a comma-separated list.
*-p, --pid-file*='<pid-file>'::
Specify the location of the 'fwknopd.pid' file. If this option is
Specify the location of the 'fwknopd.pid' file. If this option is
not given, 'fwknopd' will use the compile-time default location (typically
'@localstatedir@/run/fwknop/fwknopd.pid).
*-P, --pcap-filter*='<filter>'::
Specify a Berkeley packet filter statement on the *fwknopd* command
line. This overrides the value of the PCAP_FILTER variable taken
line. This overrides the value of the PCAP_FILTER variable taken
from the '@sysconfdir@/fwknop/fwknopd.conf'' file.
*--pcap-file*='<pcap-file>'::
This option instructs *fwknopd* to read packet data from a pcap file
instead of sniffing an interface directly. This mode is usually used for
instead of sniffing an interface directly. This mode is usually used for
debugging purposes, and will disable SPA packet age checking unless it is
manually enabled in the '@sysconfdir@/fwknop/fwknopd.conf' file.
*--pcap-any-direction*::
Allow *fwknopd* to sniff SPA packets regardless of whether they are
received on the sniffing interface or sent from the sniffing interface. In
received on the sniffing interface or sent from the sniffing interface. In
the later case, this can be useful to have fwknopd sniff SPA packets that
are forwarded through a system and destined for a different network. If
are forwarded through a system and destined for a different network. If
the sniffing interface is the egress interface for such packets (and hence
SPA packets are sent by this interface instead of received), then this
option will need to used in order for *fwknopd* to see them. The default
is to only sniff packets that are received on the sniffing interface. Note
option will need to used in order for *fwknopd* to see them. The default
is to only sniff packets that are received on the sniffing interface. Note
that this setting is independent of promiscuous mode.
*-R, --restart*::
Restart the currently running *fwknopd* processes. This option
Restart the currently running *fwknopd* processes. This option
will preserve the command line options that were supplied to the
original *fwknopd* process but will force *fwknopd* to re-read the
'fwknopd.conf' and '@sysconfdir@/fwknop/access.conf' files. This will also force a
'fwknopd.conf' and '@sysconfdir@/fwknop/access.conf' files. This will also force a
flush of the current ``FWKNOP'' iptables chain(s).
*--rotate-digest-cache*::
Rotate the digest cache file by renaming it to ``<name>-old'', and
starting a new one. The digest cache file is typically found in
starting a new one. The digest cache file is typically found in
'@localstatedir@/run/fwknop/digest.cache'.
*-S, --status*::
Display the status of any *fwknopd* processes that may or not be
running. If there is an existing fwknopd process then 0 is returned for the
running. If there is an existing fwknopd process then 0 is returned for the
exit status and 1 is returned otherwise.
*--syslog-enable*::
@@ -174,8 +184,8 @@ SPA message.
FWKNOPD.CONF VARIABLES
~~~~~~~~~~~~~~~~~~~~~~
This section list the more prominent configuration variables used by
*fwknopd*. It is not a complete list. There are directives for the type
of firewall used by *fwknopd* (i.e. _iptables_, _ipfw_, or _pf_). You will
*fwknopd*. It is not a complete list. There are directives for the type
of firewall used by *fwknopd* (i.e. _iptables_, _ipfw_, or _pf_). You will
want to make sure to check these to make sure they have appropriate values.
See the '@sysconfdir@/fwknop/fwknopd.conf'' file for the full list and corresponding details.
@@ -188,37 +198,37 @@ See the '@sysconfdir@/fwknop/fwknopd.conf'' file for the full list and correspon
*PCAP_FILTER* '<pcap filter spec>'::
Define the filter used for 'PCAP' modes; *fwknopd* defaults to UDP
port 62201. However, if an *fwknop* client uses the *--rand-port* option
port 62201. However, if an *fwknop* client uses the *--rand-port* option
to send the SPA packet over a random port, then this variable should be
updated to something like ``udp dst portrange 10000-65535''.
*ENABLE_SPA_PACKET_AGING* '<Y/N>'::
This instructs *fwknopd* to not honor SPA packets that have an old time
stamp. The value for ``old'' is defined by the ``MAX_SPA_PACKET_AGE''
variable. If ``ENABLE_SPA_PACKET_AGING'' is set to ``N'', *fwknopd*
stamp. The value for ``old'' is defined by the ``MAX_SPA_PACKET_AGE''
variable. If ``ENABLE_SPA_PACKET_AGING'' is set to ``N'', *fwknopd*
will not use the client time stamp at all.
*MAX_SPA_PACKET_AGE* '<seconds>'::
Defines the maximum age (in seconds) that an SPA packet will be accepted.
This requires that the client system is in relatively close time
synchronization with the *fwknopd* server system (NTP is good). The
synchronization with the *fwknopd* server system (NTP is good). The
default age is 120 seconds (two minutes).
*ACCESS_EXPIRE* '<MM/DD/YYYY>'::
Defines an expiration date for the access stanza in MM/DD/YYYY format.
All SPA packets that match an expired stanza will be ignored. This
All SPA packets that match an expired stanza will be ignored. This
parameter is optional.
*ACCESS_EXPIRE_EPOCH* '<seconds>'::
Defines an expiration date for the access stanza as the epoch time, and is
useful if a more accurate expiration time needs to be given than the day
resolution offered by the ACCESS_EXPIRE variable above. All SPA packets
that match an expired stanza will be ignored. This parameter is optional.
resolution offered by the ACCESS_EXPIRE variable above. All SPA packets
that match an expired stanza will be ignored. This parameter is optional.
*ENABLE_DIGEST_PERSISTENCE* '<Y/N>'::
Track digest sums associated with previous SPA packets processed by
*fwknopd*. This allows digest sums to remain persistent across
executions of *fwknopd*. The default is ``Y''. If set to ``N'',
*fwknopd*. This allows digest sums to remain persistent across
executions of *fwknopd*. The default is ``Y''. If set to ``N'',
*fwknopd* will not check incoming SPA packet data against any
previously save digests. It is a good idea to leave this feature on
to reduce the possibility of being vulnerable to a replay attack.
@@ -229,14 +239,14 @@ See the '@sysconfdir@/fwknop/fwknopd.conf'' file for the full list and correspon
chain instead of the INPUT chain).
*ENABLE_IPT_LOCAL_NAT* '<Y/N>'::
Allow SPA clients to request access to a local socket via NAT. This
Allow SPA clients to request access to a local socket via NAT. This
still puts an ACCEPT rule into the FWKNOP_INPUT chain, but a different
port is translated via DNAT rules to the real one. So, the user would
port is translated via DNAT rules to the real one. So, the user would
do ``ssh -p <port>'' to access the local service (see the *--NAT-local*
and *--NAT-rand-port* on the *fwknop* client command line).
*ENABLE_IPT_SNAT* '<Y/N>'::
Set this to ``Y'' to enable a corresponding SNAT rule. By default, if
Set this to ``Y'' to enable a corresponding SNAT rule. By default, if
forwarding access is enabled (see the ``ENABLE_IPT_FORWARDING'' variable
above), then *fwknopd* creates DNAT rules for incoming connections, but
does not also complement these rules with SNAT rules at the same time.
@@ -246,7 +256,7 @@ See the '@sysconfdir@/fwknop/fwknopd.conf'' file for the full list and correspon
internal interface where *fwknopd* is running.
*SNAT_TRANSLATE_IP* '<ip_address>'::
Specify the IP address for SNAT. This functionality is only enabled
Specify the IP address for SNAT. This functionality is only enabled
when ``ENABLE_IPT_SNAT'' is set to ``Y'' and by default SNAT rules are
built with the MASQUERADE target (since then the internal IP does not
have to be defined here in the '@sysconfdir@/fwknop/fwknopd.conf' file),
@@ -259,7 +269,7 @@ See the '@sysconfdir@/fwknop/fwknopd.conf'' file for the full list and correspon
and the OUTPUT chain has a default-drop stance.
*MAX_SNIFF_BYTES* '<bytes>'::
Specify the the maximum number of bytes to sniff per frame. 1500
Specify the the maximum number of bytes to sniff per frame. 1500
is the default.
*FLUSH_IPT_AT_INIT* '<Y/N>'::
@@ -268,11 +278,11 @@ See the '@sysconfdir@/fwknop/fwknopd.conf'' file for the full list and correspon
*FLUSH_IPT_AT_EXIT* '<Y/N>'::
Flush all existing rules in the fwknop chains when *fwknopd* is stopped
or otherwise exits cleanly. The default is ``Y''.
or otherwise exits cleanly. The default is ``Y''.
*GPG_HOME_DIR* '<path>'::
If GPG keys are used instead of a Rijndael symmetric key, this is
the default GPG keys directory. Note that each access stanza in
the default GPG keys directory. Note that each access stanza in
'@sysconfdir@/fwknop/access.conf' can specify its own GPG directory to override
this default. If not set here or in an 'access.conf' stanza, then
the '$HOME/.gnupg' directory of the user running *fwknopd* (most
@@ -282,22 +292,22 @@ GPG_EXE* '<path>'::
Specify the path to GPG, and defaults to '/usr/bin/gpg' if not set.
*LOCALE* '<locale>'::
Set the locale (via the LC_ALL variable). This can be set to override
Set the locale (via the LC_ALL variable). This can be set to override
the default system locale.
*ENABLE_SPA_OVER_HTTP* '<Y/N>'::
Allow *fwknopd* to acquire SPA data from HTTP requests (generated with
the fwknop client in *--HTTP* mode). Note that when this is enabled,
the fwknop client in *--HTTP* mode). Note that when this is enabled,
the ``PCAP_FILTER'' variable would need to be updated to sniff traffic
over TCP/80 connections and a web server should be running on the same
server as *fwknopd*.
*ENABLE_TCP_SERVER* '<Y/N>'::
Enable the fwknopd TCP server. This is a "dummy" TCP server that will
Enable the fwknopd TCP server. This is a "dummy" TCP server that will
accept TCP connection requests on the specified TCPSERV_PORT.
If set to "Y", fwknopd will fork off a child process to listen for, and
accept incoming TCP request. This server only accepts the
request. It does not otherwise communicate. This is only to allow the
accept incoming TCP request. This server only accepts the
request. It does not otherwise communicate. This is only to allow the
incoming SPA over TCP packet which is detected via PCAP. The connection
is closed after 1 second regardless.
Note that fwknopd still only gets its data via pcap, so the filter
@@ -305,26 +315,26 @@ GPG_EXE* '<path>'::
*PCAP_DISPATCH_COUNT* '<count>'::
Sets the number of packets that are processed when the *pcap_dispatch()*
call is made. The default is zero, since this allows *fwknopd* to process
call is made. The default is zero, since this allows *fwknopd* to process
as many packets as possible in the corresponding callback where the SPA
handling routine is called for packets that pass a set of prerequisite
checks. However, if *fwknopd* is running on a platform with an old
checks. However, if *fwknopd* is running on a platform with an old
version of libpcap, it may be necessary to change this value to a positive
non-zero integer. More information can be found in the *pcap_dispatch(3)*
non-zero integer. More information can be found in the *pcap_dispatch(3)*
man page.
*PCAP_LOOP_SLEEP* '<microseconds>'::
Sets the number of microseconds to passed as an argument to usleep() in
the pcap loop. The default is 10000, or 1/10th of a second.
the pcap loop. The default is 10000, or 1/10th of a second.
*ENABLE_PCAP_ANY_DIRECTION* '<Y/N>'::
Controls whether fwknopd is permitted to sniff SPA packets regardless of
whether they are received on the sniffing interface or sent from the
sniffing interface. In the later case, this can be useful to have fwknopd
sniffing interface. In the later case, this can be useful to have fwknopd
sniff SPA packets that are forwarded through a system and destined for a
different network. If the sniffing interface is the egress interface for
different network. If the sniffing interface is the egress interface for
such packets, then this variable will need to be set to "Y" in order for
fwknopd to see them. The default is "N" so that fwknopd only looks for SPA
fwknopd to see them. The default is "N" so that fwknopd only looks for SPA
packets that are received on the sniffing interface (note that this is
independent of promiscuous mode).
@@ -333,40 +343,40 @@ GPG_EXE* '<path>'::
is only spawned when ``ENABLE_TCP_SERVER'' is set to ``Y''.
*SYSLOG_IDENTITY* '<identity>'::
Override syslog identity on message logged by *fwknopd*. The defaults
Override syslog identity on message logged by *fwknopd*. The defaults
are usually ok.
*SYSLOG_FACILITY* '<facility>'::
Override syslog facility. The ``SYSLOG_FACILITY'' variable can be set to
Override syslog facility. The ``SYSLOG_FACILITY'' variable can be set to
one of ``LOG_LOCAL{0-7}'' or ``LOG_DAEMON'' (the default).
ACCESS.CONF VARIABLES
~~~~~~~~~~~~~~~~~~~~~
This section describes the access control directives in the '@sysconfdir@/fwknop/access.conf'
file. Theses directives define encryption keys and level of access that
file. Theses directives define encryption keys and level of access that
is granted to *fwknop* clients that have generated the appropriate
encrypted message.
The 'access.conf' variables described below provide the access directives
for the SPA packets with a source (or embedded request) IP that matches an
address or network range defined by the ``SOURCE'' variable. All variables
following ``SOURCE'' apply to the source 'stanza'. Each ``SOURCE''
address or network range defined by the ``SOURCE'' variable. All variables
following ``SOURCE'' apply to the source 'stanza'. Each ``SOURCE''
directive starts a new stanza.
*SOURCE* '<IP,..,IP/NET,..,NET/ANY>'::
This defines the source address from which the SPA packet will be
accepted. The string ``ANY'' is also accepted if a valid SPA packet
should be honored from any source IP. Every authorization stanza in
accepted. The string ``ANY'' is also accepted if a valid SPA packet
should be honored from any source IP. Every authorization stanza in
'@sysconfdir@/fwknop/access.conf' definition must start with the ``SOURCE'' keyword.
Networks should be specified in CIDR notation (e.g. ``192.168.10.0/24''),
and individual IP addresses can be specified as well. Also, multiple
and individual IP addresses can be specified as well. Also, multiple
IP's and/or networks can be defined as a comma separated list (e.g.
``192.168.10.0/24,10.1.1.123'')
*OPEN_PORTS* '<proto/port>,...,<proto/port>'::
Define a set of ports and protocols (tcp or udp) that will be
opened if a valid knock sequence is seen. If this entry is not set,
opened if a valid knock sequence is seen. If this entry is not set,
*fwknopd* will attempt to honor any proto/port request specified in the
SPA data (unless of it matches any ``RESTRICT_PORTS'' entries). Multiple
entries are comma-separated.
@@ -378,66 +388,66 @@ directive starts a new stanza.
*KEY* '<passphrase>'::
Define the symmetric key used for decrypting an incoming SPA packet that is
encrypted by the *fwknop* client with Rijndael. The actual encryption key
that is used is derived from the standard PBKDF1 algorithm. This variable
encrypted by the *fwknop* client with Rijndael. The actual encryption key
that is used is derived from the standard PBKDF1 algorithm. This variable
is required for all SPA packets unless GnuPG is used instead (see the GPG
variables below).
*KEY_BASE64* '<base64 encoded passphrase>'::
Same as the *KEY* option above, but specify the symmetric key as a base64
encoded string. This allows non-ascii characters to be included in the
encoded string. This allows non-ascii characters to be included in the
base64-decoded key.
*HMAC_KEY* '<key>'::
Specify the HMAC key for authenticated encryption of SPA packets. This
Specify the HMAC key for authenticated encryption of SPA packets. This
supports both Rijndael and GPG encryption modes, and is applied according
to the encrypt-then-authenticate model.
*HMAC_KEY_BASE64* '<base64 encoded key>'::
Specify the HMAC key as a base64 encoded string. This allows non-ascii
Specify the HMAC key as a base64 encoded string. This allows non-ascii
characters to be included in the base64-decoded key.
*FW_ACCESS_TIMEOUT* '<seconds>'::
Define the length of time access will be granted by *fwknopd* through the
firewall after a valid knock sequence from a source IP address. If
firewall after a valid knock sequence from a source IP address. If
``FW_ACCESS_TIMEOUT'' is not set then the default timeout of 30 seconds
will automatically be set.
*ENCRYPTION_MODE* '<mode>'::
Specify the encryption mode when AES is used. The default is CBC mode,
but other modes can be selected such as OFB and CFB. In general, it is
recommended to not use this variable and leave it as the default. Note
Specify the encryption mode when AES is used. The default is CBC mode,
but other modes can be selected such as OFB and CFB. In general, it is
recommended to not use this variable and leave it as the default. Note
that the string ``legacy'' can be specified in order to generate SPA
packets with the old initialization vector strategy used by versions of
*fwknop* before 2.5. With the 2.5 release, *fwknop* uses PBKDF1 for key
*fwknop* before 2.5. With the 2.5 release, *fwknop* uses PBKDF1 for key
derivation.
*HMAC_DIGEST_TYPE* '<digest algorithm>'::
Specify the digest algorithm for incoming SPA packet authentication. Must
be one of *MD5*, *SHA1*, *SHA256*, *SHA384*, or *SHA512*. This is an
Specify the digest algorithm for incoming SPA packet authentication. Must
be one of *MD5*, *SHA1*, *SHA256*, *SHA384*, or *SHA512*. This is an
optional field, and if not specified then *fwknopd* defaults to using
SHA256 if the access stanza requires an HMAC.
*ENABLE_CMD_EXEC* '<Y/N>'::
This instructs *fwknopd* to accept complete commands that are contained
within an authorization packet. Any such command will be executed on
within an authorization packet. Any such command will be executed on
the *fwknopd* server as the user specified by the ``CMD_EXEC_USER'' or
as the user that started *fwknopd* if that is not set.
*CMD_EXEC_USER* '<username>'::
This specifies the user that will execute commands contained within a SPA
packet. If not specified, fwknopd will execute it as the user it is
packet. If not specified, fwknopd will execute it as the user it is
running as (most likely root). Setting this to a non-root user is highly
recommended.
*REQUIRE_USERNAME* '<username>'::
Require a specific username from the client system as encoded in the SPA
data. This variable is optional and if not specified, the username data
data. This variable is optional and if not specified, the username data
in the SPA data is ignored.
*REQUIRE_SOURCE_ADDRESS* '<Y/N>'::
Force all SPA packets to contain a real IP address within the
encrypted data. This makes it impossible to use the *-s* command
encrypted data. This makes it impossible to use the *-s* command
line argument on the *fwknop* client command line, so either *-R* has
to be used to automatically resolve the external address (if the
client behind a NAT) or the client must know the external IP and set it
@@ -445,20 +455,20 @@ directive starts a new stanza.
*FORCE_NAT* '<IP> <PORT>'::
For any valid SPA packet, force the requested connection to be NAT'd
through to the specified (usually internal) IP and port value. This is
through to the specified (usually internal) IP and port value. This is
useful if there are multiple internal systems running a service such as
SSHD, and you want to give transparent access to only one internal system
for each stanza in the access.conf file. This way, multiple external
for each stanza in the access.conf file. This way, multiple external
users can each directly access only one internal system per SPA key.
*FORCE_SNAT* '<IP>'::
For any valid SPA packet, add an SNAT rule in addition to any DNAT rule
created with a corresponding (required) FORCE_NAT variable. This is
created with a corresponding (required) FORCE_NAT variable. This is
analogous to ``SNAT_TRANSLATE_IP'' from the '@sysconfdir@/fwknop/fwknopd.conf'
file except that it is per access stanza and overrides any value set with
``SNAT_TRANSLATE_IP''. This is useful for situations where an incoming
``SNAT_TRANSLATE_IP''. This is useful for situations where an incoming
NAT'd connection may be otherwise unanswerable due to routing constraints
(i.e. the system receiving the SPA authenticated connection has a default
(i.e. the system receiving the SPA authenticated connection has a default
route to a different device than the SPA system itself).
*FORCE_MASQUERADE* '<Y/N>'::
@@ -468,13 +478,13 @@ directive starts a new stanza.
*GPG_DECRYPT_ID* '<keyID>'::
Define a GnuPG key ID to use for decrypting SPA messages that
have been encrypted by an *fwknop* client. This keyword is
required for authentication that is based on GPG keys. The GPG
have been encrypted by an *fwknop* client. This keyword is
required for authentication that is based on GPG keys. The GPG
key ring on the client must have imported and signed the *fwknopd*
server key, and vice versa. It is ok to use a sensitive
server key, and vice versa. It is ok to use a sensitive
personal GPG key on the client, but each *fwknopd* server should
have its own GPG key that is generated specifically for fwknop
communications. The reason for this is that the decryption
communications. The reason for this is that the decryption
password for the server key must be placed within the '@sysconfdir@/fwknop/access.conf'
file for *fwknopd* to function (it has to be able to decrypt SPA
messages that have been encrypted with the server's public key).
@@ -483,12 +493,12 @@ directive starts a new stanza.
*GPG_DECRYPT_PW* '<decrypt password>'::
Specify the decryption password for the gpg key defined by the
``GPG_DECRYPT_ID'' above. This is a required field for gpg-based
``GPG_DECRYPT_ID'' above. This is a required field for gpg-based
authentication.
*GPG_ALLOW_NO_PW* '<Y/N>'::
Allow *fwknopd* to leverage a GnuPG key pair that does not have an
associated password. While this may sound like a controversial deployment
associated password. While this may sound like a controversial deployment
mode, in automated environments it makes sense because "there is usually no
way to store a password more securely than on the secret keyring itself"
according to: ``http://www.gnupg.org/faq/GnuPG-FAQ.html#how-can-i-use-gnupg-in-an-automated-environment''.
@@ -498,27 +508,27 @@ directive starts a new stanza.
*GPG_REQUIRE_SIG* '<Y/N>'::
With this setting set to 'Y', fwknopd check all GPG-encrypted SPA
messages for a signature (signed by the sender's key). If the incoming
message is not signed, the decryption process will fail. If not set, the
messages for a signature (signed by the sender's key). If the incoming
message is not signed, the decryption process will fail. If not set, the
default is 'N'.
*GPG_IGNORE_SIG_VERIFY_ERROR* '<Y/N>'::
Setting this will allow fwknopd to accept incoming GPG-encrypted packets
that are signed, but the signature did not pass verification (i.e. the
signer key was expired, etc.). This setting only applies if the
signer key was expired, etc.). This setting only applies if the
GPG_REQUIRE_SIG is also set to 'Y'.
*GPG_REMOTE_ID* '<keyID,...,keyID>'::
Define a list of gpg key ID's that are required to have signed
any incoming SPA message that has been encrypted with the
*fwknopd* server key. This ensures that the verification of the
*fwknopd* server key. This ensures that the verification of the
remote user is accomplished via a strong cryptographic mechanism.
This setting only applies if the ``GPG_REQUIRE_SIG'' is set to 'Y'.
Separate multiple entries with a comma.
*GPG_HOME_DIR* '<path>'::
Define the path to the GnuPG directory to be used by the *fwknopd*
server. If this keyword is not specified within '@sysconfdir@/fwknop/access.conf'
server. If this keyword is not specified within '@sysconfdir@/fwknop/access.conf'
then *fwknopd* will default to using the '/root/.gnupg' directory for the
server key(s) for incoming SPA packets handled by the matching
'access.conf' stanza.
@@ -557,13 +567,13 @@ firewall is required on the underlying operating system.
DIAGNOSTICS
-----------
*fwknopd* can be run in debug mode by combining the *-f, --foreground* and
the *-v, --verbose* command line options. This will disable daemon mode
the *-v, --verbose* command line options. This will disable daemon mode
execution, and print verbose information to the screen on stderr as packets
are received.
The most comprehensive way to gain diagnostic information on *fwknopd* is to run
the test suite 'test-fwknop.pl' script located in the 'test/' directory in the fwknop
sources. The test suite runs sends fwknop through a large number of run time
sources. The test suite runs sends fwknop through a large number of run time
tests, has 'valgrind' support, validates both SPA encryption and HMAC results
against OpenSSL, and even has its own built in fuzzer for SPA communications.
@@ -574,9 +584,9 @@ fwknopd(8), iptables(8), pf(4), pfctl(8), ipfw(8), gpg(1), libfko documentation.
More information on Single Packet Authorization can be found in the paper
``Single Packet Authorization with fwknop'' available at
'http://www.cipherdyne.org/fwknop/docs/SPA.html'. A comprehensive tutorial
'http://www.cipherdyne.org/fwknop/docs/SPA.html'. A comprehensive tutorial
on *fwknop* operations and theory can be found at
'http://www.cipherdyne.org/fwknop/docs/fwknop-tutorial.html'. This tutorial
'http://www.cipherdyne.org/fwknop/docs/fwknop-tutorial.html'. This tutorial
also includes information about the design of *fwknop* that may be worth
reading for those interested in why fwknop is different from other SPA
implementations.
@@ -602,9 +612,9 @@ CONTRIBUTORS
------------
This ``C'' version of fwknop was derived from the original Perl-based version
on which many people who are active in the open source community have
contributed. See the CREDITS file in the fwknop sources, or visit
contributed. See the CREDITS file in the fwknop sources, or visit
'http://www.cipherdyne.org/fwknop/docs/contributors.html' to view the online
list of contributors. A few contributors deserve to be singled out including:
list of contributors. A few contributors deserve to be singled out including:
Franck Joncourt, Max Kastanas, Vlad Glagolev, Sean Greven, Hank Leininger,
Fernando Arnaboldi, and Erik Gomez.
@@ -615,8 +625,8 @@ Nomad at the BlackHat Briefings of 2005.
BUGS
----
Send bug reports to dstuart@dstuart.org or mbr@cipherdyne.org, or open a new
issue on Github (see 'https://github.com/mrash/fwknop.git'). Suggestions
and/or comments are always welcome as well. Additional information may be
issue on Github (see 'https://github.com/mrash/fwknop.git'). Suggestions
and/or comments are always welcome as well. Additional information may be
found in the *fwknop* mailing list archives (see:
'https://lists.sourceforge.net/lists/listinfo/fwknop-discuss').
server/cmd_opts.h
+2
View File
@@ -126,6 +126,7 @@ enum {
ROTATE_DIGEST_CACHE,
SYSLOG_ENABLE,
DUMP_SERVER_ERR_CODES,
EXIT_AFTER_PARSE_CONFIG,
NOOP /* Just to be a marker for the end */
};
@@ -143,6 +144,7 @@ static struct option cmd_opts[] =
{"digest-file", 1, NULL, 'd'},
{"dump-config", 0, NULL, 'D'},
{"dump-serv-err-codes", 0, NULL, DUMP_SERVER_ERR_CODES },
{"exit-parse-config", 0, NULL, EXIT_AFTER_PARSE_CONFIG },
{"syslog-enable", 0, NULL, SYSLOG_ENABLE },
{"foreground", 0, NULL, 'f'},
{"help", 0, NULL, 'h'},
server/config_init.c
+4
View File
@@ -887,6 +887,10 @@ config_init(fko_srv_options_t *opts, int argc, char **argv)
case DUMP_SERVER_ERR_CODES:
dump_server_errors();
clean_exit(opts, NO_FW_CLEANUP, EXIT_SUCCESS);
case EXIT_AFTER_PARSE_CONFIG:
opts->exit_after_parse_config = 1;
opts->foreground = 1;
break;
case 'f':
opts->foreground = 1;
break;
server/fwknopd.8.in
+15 -2
View File
@@ -2,12 +2,12 @@
.\" Title: fwknopd
.\" Author: [see the "AUTHORS" section]
.\" Generator: DocBook XSL Stylesheets v1.78.1 <http://docbook.sf.net/>
.\" Date: 04/29/2014
.\" Date: 05/04/2014
.\" Manual: Fwknop Server
.\" Source: Fwknop Server
.\" Language: English
.\"
.TH "FWKNOPD" "8" "04/29/2014" "Fwknop Server" "Fwknop Server"
.TH "FWKNOPD" "8" "05/04/2014" "Fwknop Server" "Fwknop Server"
.\" -----------------------------------------------------------------
.\" * Define some portability stuff
.\" -----------------------------------------------------------------
@@ -107,6 +107,13 @@ derives from the
on stderr\&.
.RE
.PP
\fB\-\-dump\-serv\-err\-codes\fR
.RS 4
Dump all possible
\fBfwknopd\fR
error codes to stdout and exit\&. This option is rarely needed in practice, and was added to assist with test coverage\&.
.RE
.PP
\fB\-\-fw\-list\-all\fR
.RS 4
List all firewall rules including those that have nothing to do with
@@ -131,6 +138,12 @@ process\&. This provides a quick and easy way to stop
without having to look in the process table\&.
.RE
.PP
\fB\-\-exit\-parse\-config\fR
.RS 4
Parse config files (\fI@sysconfdir@/fwknop/fwknopd\&.conf\fR,
\fI@sysconfdir@/fwknop/access\&.conf\fR, the digest cache file, etc\&.) and exit\&. This provides a way to test whether the config files are properly structured without having to start processing network traffic\&.
.RE
.PP
\fB\-l, \-\-locale\fR=\fI<locale>\fR
.RS 4
Set/override the system default locale setting\&.
server/fwknopd.c
+6
View File
@@ -323,6 +323,12 @@ main(int argc, char **argv)
);
}
if(opts.exit_after_parse_config)
{
log_msg(LOG_INFO, "Configs parsed, exiting.");
clean_exit(&opts, NO_FW_CLEANUP, EXIT_SUCCESS);
}
/* Prepare the firewall - i.e. flush any old rules and (for iptables)
* create fwknop chains.
*/
server/fwknopd_common.h
+1
View File
@@ -479,6 +479,7 @@ typedef struct fko_srv_options
unsigned char fw_flush; /* Flush current firewall rules */
unsigned char test; /* Test mode flag */
unsigned char verbose; /* Verbose mode flag */
unsigned char exit_after_parse_config; /* Parse config and exit */
unsigned char ipt_disable_check_support; /* Don't use iptables -C */
server/fwknopd_errors.h
+1
View File
@@ -70,6 +70,7 @@ enum {
/* Function prototypes
*/
const char* get_errstr(const int err_code);
void dump_server_errors(void);
#endif /* FWKNOPD_ERRORS_H */